RESTification

This PR closes #23.  It updates the overall flow of the protocol to make better use of HTTP.  There are no changes to the validation challenges.  In case it helps, there's a side-by-side comparison of protocol messages here:

http://www.ipv.sx/tmp/restification.html 
Nothing like hash commitment to make this game easy and public.  Client generates a random value and provides that to the server when it requests the creation of an authorization resource.  Then you can provide this to all comers and they can play a "find-the-collision" game (maybe it starts and ends with "acme-recovery" to make collisions extra hard to manufacture).